Recommendation: For information only Respond to

Page 1 of Report CA-18-13

City Manager's Office TO: Audit Committee

SUBJECT: Summary of Audit Results – Building Administration and Licensing

Report Number: CA-18-13 File Number(s): 430-03-Planning and Building

Report Date: August 12, 2013 Ward(s) Affected: 1 2 3 4 5 6 All

Date to Committee: September 10, 2013 Date to Council: September 23, 2013

Recommendation: For information only

Purpose: Address goal or action in strategic plan

Establish new or revised policy or service standard

Respond to legislation

Respond to staff direction

Address other area of responsibility Considering reports from the City Manager and the City Auditor identifying audit issues and the steps taken to resolve them including the adequacy of the management responses to audit concerns

Reference to Strategic Plan:

Vibrant Neighbourhoods Prosperity Excellence in Government N/A

Background: The audit was included in the work plan since the area has not been audited before.

Discussion:

Overall Audit Rating – FAIR (details of the overall audit ratings are located on page 21 of this report)

Summary of Audit Findings & Severity (Measure of Residual Risk)

Category High Medium Low Monitoring and Oversight 1 0 2 Cash Handling 0 1 0 Customer Administration 1 1 0 Lottery Compliance 0 0 1


Details of Audit Finding Severity Scale are located on page 21 of this report.

The audit report is as follows:

• Summary of Audit Results is located on page 4 of this report • Detailed Audit Report is located on page 7 of this report. • Detailed Audit Findings, Recommendations & Management Action Plans are

located on page 10 of this report. Management disagreed with audit recommendation in finding number four to further restrict access to safe, because management completed a review of that process and concluded that there is a business need for such access. Management has agreed to start changing the safe combination periodically.

Financial Matters:

Estimated audit hours for completion: 125 - 175 hours Actual hours required to complete: 175 hours

Communication Matters:

Audit closing meeting conducted on July 23, 2013. Provided opportunity for discussion between the Manager of By-Law

Enforcement & Licensing, Supervisor of Licensing & Permit Administration, the City Auditor and the Internal Auditor.

Management provided management action plans located in Appendix A-2 on page 10 of this report.

Final report issued to management on August 7, 2013

Conclusion:

The Building Administration and Licensing is a mature and well established function. Opportunities for improvement include:

Enhancements to monitoring and oversight to prevent errors and unauthorized activity.

Reviews of existing processes to ensure compliance with privacy laws and AGCO regulations.

Ensuring that authority to issue business licenses is appropriately delegated.


Respectfully submitted, Original signed by Lenka Watson Lenka Watson Auditor (289) 983-5062

Approvals: *required

Original signed by Sheila Jones n/a n/a

Original signed by Jeff Fielding

*Department Head City Treasurer General Manager City Manager

To be completed by the Clerks Department Committee Disposition & Comments

01-Approved 02-Not Approved 03-Amended 04-Referred 06-Received & Filed 07-Withdrawn

Council Disposition & Comments

01-Approved 02-Not Approved 03-Amended 04-Referred 06-Received & Filed 07-Withdrawn

Appendices: A Building Administration and Licensing Summary of Audit Results and Detailed Audit Report A-1 Detailed Findings, Recommendations & Management Action Plans A-2 Additional Observations

Notifications: (after Council decision)

Name Mailing or E-mail Address


Appendix A

AUDIT INFORMATION

Audit Unit Building Administration & Licensing

Distribution Tracey Burrows, Manager By-Law Enforcement & Licensing Nancy Reid, Supervisor

Department Planning & Building cc Bruce Krushelnicki, Director

Division Development & Infrastructure Scott Stewart, General Manager

Date Issued August 7, 2013

Nancy Shea-Nicol, City Solicitor

Author

Lenka Watson, Internal Auditor Sheila Jones, City Auditor

Jeff Fielding, City Manager

SUMMARY OF AUDIT RESULTS

Area of Focus

Audit Period May 1, 2012 to May 31, 2013

What is Working Well

The Building Administration and Licensing function within the City of Burlington is well established as evidenced by the following: • Documented job descriptions for all roles within the department; • Documented procedures for most areas in scope including, but not

limited to: Entering a New Licence, Running Renewal Notices, Sign Permit Procedures, POS System Manual, Bingo Report Auditing Procedures, etc.;

• Tools and checklists (e.g., requirements documents for all business license types, requirements package for lottery license, etc.)

• The team is knowledgeable about the areas of their responsibility and in general is following the procedures effectively as evidenced by audit results;


• The team is engaged and ongoing efforts take place to improve operations and innovate including ongoing enhancements to AMANDA and the recent re-organization to develop and cross-train the team.

Findings by Severity (see definitions on Page 21 of this report)

Category High Medium Low Monitoring and Oversight 1 0 2 Cash Handling 0 1 0 Customer Administration 1 1 0 Lottery Compliance 0 0 1

Refer to Appendix A-1 (page 10 of this report) for details of the audit findings and recommendations

Overall Rating (see definitions on Page 21 of this report)

FAIR

Why?

Monitoring and Oversight Cash Handling

Customer Administration

Lottery Compliance

• Manual overrides of business license data are not tracked or monitored.

• Supervisory review was not evidenced for almost 30% of voided, refunded and cancelled transactions.

• Cash handling procedures are not being consistently followed.

• Customer Service Representatives are acting as Licensing Officers although they do not have the appropriate delegation of authority.

• Since the City collects and retains private data as part of the Licensing & Permits process, a review is required to ensure compliance with laws and best practices related to collection and retention of private data.

• A review of Burlington’s lottery compliance framework should be

considered to ensure the framework is up to date and in accordance with laws and regulations.

Closing Comments

We thank management and staff of Building Administration & Licensing for the cooperation and support extended to us during this audit.


Management Comments

The audit of the Building Administration and Licensing Unit was conducted in such a way as to be as unobtrusive as possible. Both Sheila and Lenka were able to gather relevant information while the CSR’s were still able to carry on with their assigned duties. The timing and the length of the audit worked was also advantageous in that we were well into our busy spring and summer seasons, but were under control. The audit has provided management an opportunity to look at ways in which we can provide both a better customer service, but a more informed service as well. Management is looking forward to fulfilling the recommendations in a timely fashion.


DETAILED AUDIT REPORT

Building Administration & Licensing Responsibilities

Governing By-laws Channels Systems

• Located within the Planning & Building Department • Primary goal is to provide excellent customer service.

• Responsible for: issuance of: business licences (e.g., taxi cab driver, adult entertainment, food

services, automotive, etc.) lottery licences (e.g., bingo, raffles, bazaar, etc.) sign permits (e.g., permanent and temporary) pool permits noise exemptions

eligibility assessment for lottery licences records management including imaging customer inquiry (e.g., application process, freedom of information

requests, property information requests, etc.) complaint handling payment processing and cash handling.

• By-laws related to eligibility, applicability and fees for licences and permits issued: Adult Entertainment 1-2008 Business Licensing 42-2008 Lottery Licensing 117-2007 Pools & Pool Fencing 74-2005 Sale of Christmas Trees 149-1992 Signs 34-2007 Taxi & Limousine 20-2009 Noise and Nuisance By-law 19-2003

• Licences and permits are provided through counter, mail and web**

channels. ** web service is limited to renewal of licences for personal services, sale of tobacco and sale of foodstuff, as well as property information requests. • AMANDA - processing licences and permits; • CLASS POS (Point of Sale) - payment processing; • Excel spreadsheets - support the operations.

Staffing

The unit is staffed by: 1 Manager (also responsible for by-law enforcement and animal

control); 1 Supervisor; 5 Customer Service Representatives; and 1 Intern (summer only).


Revenue & Numbers

Type

2013 to May 31

2012 2011

$ # $ # $ # Business Licence

91,761 368 229,472 859 202,160 813

Sign Permit (Permanent & Temporary)

92,705 817 197,504 1,788 215,220 1859

Pool Permit

30,741 112 56,049 208 48,522 189

Lottery Licence

111,089 88 226.207 185 222,899 208

Internal Partnerships

• Finance • ITS (AMANDA and POS support) • By-Law Enforcement • Building • Fire • Zoning • Clerks (Imaging and Records Management)

Audit Objectives

To assess the following: Efficiency and effectiveness of policies, procedures and control

measures related to licensing and permit issuance including records management;

The operating effectiveness of financial controls, specifically cash handling procedures and revenue management;

Staff compliance to legislative regulations related to lottery licensing compliance audits.

Audit Scope

Specifically, the review focused on: Review of policies, procedures, and related legislative regulations; Interviews with relevant supervisory and customer service staff; Observation and retesting of procedures for cash handling, licensing

and compliance audit processes; and Examination of relevant records, reports, and files including financial

documentation and supporting financial policies and procedures. The scope of the review specifically excluded:

VISA Reconciliation Imaging – off-site by Access Systems General Administration Complaint Handling

Role of Management & Inherent Risk

Responsible for designing internal controls to mitigate the inherent risks and to meet the following objectives:

Safeguarding of assets (including reputation)


Compliance with laws, regulations and corporate policies Reliability and integrity of financial and operational information Efficiency and effectiveness of operations.

Risk Category Risk Rating Performance & Responsibility Risk High Client/Customer Risk High Process Risk High Unauthorized Activity Risk High Community Trust/Confidence Risk Medium Privacy and Confidentiality Medium Theft and Fraud – Internal Risk Medium

Legend: High – significant/large/critical impact on City operations, financial results and/or image Medium – moderate/modest/sensitive impact on City operations financial results and/or image Low – insignificant/little/subtle impact on City operations, financial results and/or image


APPENDIX A-1: DETAILED FINDINGS, RECOMMENDATIONS & MANAGEMENT ACTION PLANS

No. Audit Finding

Risk Category & Severity

Rating Recommendations Management Action Plan Monitoring and Oversight

1. What is happening • The business licence fees, late fees

and business licence expiry dates generated by the system (AMANDA) are manually changed by staff without a trail.

• Evidence was not available for the

supervisory review of voided, refunded and cancelled transactions for 28% (eight out of 29) of dates tested.

Although overrides may occur for valid business reasons, management may not detect unauthorized activity or errors, if the transactions are not monitored or the monitoring is not effective. What is required Using system generated fields for fees and dates is a control to support accurate processing of applications. Changes to system generated fields should be tracked and monitored to ensure activity is legitimate and authorized. Why does this happen Monitoring and oversight activities have not been fully implemented.

Unauthorized Activity Risk

High

Design and implement appropriate Supervisory monitoring and analysis.

Also consider the following

to create an audit trail in AMANDA: • Work with ITS to

investigate a systematic solution and reporting capabilities including the feasibility of 1) system logging of changes to key fields, 2) adding “Adjustments” line to bills created in AMANDA and disabling overrides of system generated fees.

Comment: Agree Action Plan: 1. Review with ITS the

feasibility to monitor AMANDA overrides.

2. Generate AMANDA reports

for review and analysis by Supervisor of Licensing and Permit Administration.

3. Review with Finance

Department POS reports available to assist with monitoring POS transactions.

4. Supervisor of Licensing and

Permit Administration to generate reports, review and follow up on any abnormal transactions.

Responsibility: Supervisor of Licensing and Permit Administration Target Date: 1. September 30, 2013 - meet

with ITS staff subject to ITS



No. Audit Finding


Rating Recommendations Management Action Plan What is the impact Building Administration and Licensing may not detect unauthorized activity or errors resulting in financial losses.

staff availability.

2. October 31, 2013 - generate AMANDA reports and monitor overrides.

3. Complete

4. September 30, 2013 - generate POS reports and monitor transactions.

2. What is happening Business licences are issued for periods shorter than 12 months. What is required The By-law 42-2008 deems every Licence issued under the By-law as valid for a period of 12 months from date of issuance unless otherwise specified. Why is this happening In absence of any other direction, staff has responded to customer requests for pro-rated licenses. What is the impact Shorter licence periods represent lost revenue to the City, increased risk of businesses operating without a licence and a risk that customers are not being treated in a fair and equitable manner.


Low

Consider a review of this practice and establish guidelines for amendments to business licence expiry date.

Comment: Agree - The practice of prorating licences was in response to requests from business owners for a variety of reasons. An example is when a business intends to close prior to the next renewal date. Generally, staff receives very few requests to prorate licensing fees and most importantly the by-law clearly states licenses are to be issued for a year. Therefore, it is appropriate to discontinue the practice of prorating licenses. Action Plan: All licenses are to be issued for 12 months unless otherwise noted in accordance with the



No. Audit Finding


Rating Recommendations Management Action Plan Licensing By-law.

Responsibility: Supervisor of Licensing and

Permit Administration Customer Service

Representatives Target Date: Completed

3. What is happening While we were unable to reconcile AMANDA to POS as part of the audit, staff interviewed identified instances when customers applied and paid for a business licence, but did not receive the licence from the City. What is required Applicants should receive their licenses and permits once payment is received. Why is this happening AMANDA (the system used to track and generate the licensing and permits activity) and POS (the system used to record licensing fee proceeds) are not integrated and the activity in the two systems is not compared or monitored. What is the impact As a result, licences may be issued and


Low

Investigate the cost versus benefit of reconciling revenue per AMANDA to POS to assess the nature and extent of discrepancies between the two systems and the need for further monitoring.

Comment: Agree Action Plan: 1. Consult with Finance

Department and ITS Department about the cost versus benefit of reconciling revenue per AMANDA to POS.

2. Review the cost and assess

the value in proceeding with proposal and consider other means of monitoring if found necessary.

Responsibility: Manager of By-law

Enforcement and Licensing Supervisor of Licensing and

Permit Administration



No. Audit Finding


Rating Recommendations Management Action Plan tracked in AMANDA without collecting the accurate POS fee or customers could be dissatisfied if they never receive the licence they paid for via the POS.

Target Date: 1. November 30, 2013 -

consult with ITS and Finance.

2. November 30, 2013 - review cost and value and review other possible means of monitoring.

Cash Handling 4. What we found

• All Customer Service Representatives (CSRs) have access to the safe and the combination to the safe is not regularly changed (despite turnover in staff).

• Currently, only the CSR counts the

opening float and only if the float was not counted the night before.

• Deposits are left unattended on the

Supervisor’s desk. Reviewed deposits are returned to the CSR unsealed.

What is required The Cash Handling Procedures require the Supervisor and staff to remove floats from the safe and place in individual cash registers; and to verify floats

Theft and Fraud –

Internal Risk

Medium

Restrict access to safe based on business need only (e.g., to Supervisor responsible for end of day activities).

Execute opening float counts according to the procedure.

Amend the deposit process to require dual custody until the envelope is sealed.

Comment: Disagree with restricting access to safe. A new business plan was recently developed for the administration section which requires all CSRs to have access to the safe. Action Plan: 1. The safe combination is to

be changed yearly.

2. Deposit to be completed by CSR and then checked by supervisor together with CSR.

3. The responsibility of checking the float is to be rotated and a different CSR is to count the float in the morning than the night



No. Audit Finding


Rating Recommendations Management Action Plan Why is this happening Lack of monitoring and oversight to ensure procedures are followed What is the impact Lack of cash handling controls may results in undetected theft and losses.

before.

4. The Supervisor of Licensing and Permit Administration will without notice periodically count the float.



Representatives Target Date: September 30, 2013 - safe combination is to be changed. Completed - new deposit and float procedures.

Customer Administration 5. What is happening

CSRs are acting in the capacity of Licensing Officers when signing business licences, even though the authority has not been appropriately delegated to them. What is required The By-law 42-2008 defines the “Licensing Officer” as the Director or designate appointed by the Council of the City to issue Licences.

Community Trust/

Confidence Risk

High

Review the current delegation of authority and ensure that individuals acting as Licensing Officer (or on behalf of the Licensing Officer) have been appointed through the appropriate authority.

Comment: Agree Action Plan: 1. Work with ITS to modify the

Business Licence template to include the licence type issued and by-law number. And incorporate the Manager’s electronic signature as signing approval on all licences issued.



No. Audit Finding


Rating Recommendations Management Action Plan Why is this happening Council has not appointed the CSRs as Licensing Officer designates. What is the impact Issued licences may not be considered valid and authorized.

2. Consult with Legal

Department to ensure the current practice for issuing business licenses is meeting the requirement and intent of the Licensing By-law.

Responsibility: Manager of By-law

Enforcement and Licensing Supervisor of Licensing and


Representatives Target Date: 1. August 30, 2013 - meet with

Legal Department staff. 2. September 30, 2013 -

modify business licence template subject to ITS availability (the template is generated based on information in AMANDA therefore it will be necessary for ITS to modify the current information fields in AMANDA).



No. Audit Finding


Rating Recommendations Management Action Plan 6. What is happening

Burlington requires sports organizations applying for lottery licence to submit names and birthdates of members and if possible to provide their addresses and phone numbers. The lottery eligibility package (requesting the private information), is handed out to customers without any privacy notice. In addition the City requires applicants for certain business licences to submit a driver’s licence for inspection and the City retains copies of the driver’s licence as part of the application file. Burlington’s formal policy to support the legislation and its requirements is in a draft form at this time and it is anticipated to go to Council in September. What is required Limit collection and retention of private data to business need, collect and retain the private data in accordance with laws and regulations; i.e., the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). Also consider best practices (CSA's Model Code for the Protection of Personal Information).

Privacy and Confidentiality

Medium

Review both instances identified with the Records Coordinator to ensure compliance with regulations and best practices related to collection and retention of personal information.

Comment: Agree Action Plan: 1. Review all applications and

application requirements (documents to be submitted) with Clerks Department, Records Coordinator to ensure compliance related to collection and retention of personal information.

2. Implement new documentation retention practices as necessary and make required revisions to application forms as needed.



Representatives Target Date: 1. August 30, 2013 -first

meeting with Records Coordinator confirmed for August 12, 2013 to review all applications.

2. October 31, 2013 - it is



No. Audit Finding


Rating Recommendations Management Action Plan Why is this happening Privacy related regulations and best practices were not fully considered. What is the impact Burlington may be either in non-compliance with applicable regulations or may not be following the best practices for collection and retention of personal information.

anticipated that any new documentation retention practices and required changes to application forms will be in place.

Lottery Compliance 7. What is happening

• Five out of eight (63%) Charitable Gaming Reports included in our sample were not received within one month and often were several months late.

• Four out of 51 (8%) of charities had

audits pending for several months.

The audit scope was expanded to analyze 2013 trends, since the sample tested related to 2012 transactions and management indicated the trend has improved significantly in 2013. The 2013 analysis showed a decline in delays with only a three day average delay for the April 2013 submission. However, the 2013 review also identified the pending audits.

Community Trust/

Confidence Risk

Low

Consider developing a plan to address the audit delay and continue tracking trends in Charitable Gaming Report submissions.

Comment: Agree. In the past a large number of audit reports were received beyond the due date. Over the past year a strong effort has been made to ensure charities submit their audits in a timely manner. Measures taken to reduce the number of pending audits: issuing written letters of

notice to charities when audits are late,

staff conducted a Lottery workshop for charities about audit reports and reviewed the necessary documents required.

a detailed step by step audit checklist was developed to assist charities in preparing audit reports.



No. Audit Finding


Rating Recommendations Management Action Plan

What is required The Lottery Licence T&Cs require licensees to submit charitable licences within one month.

Why is this happening Pending audits are mainly relating to a staff on maternity leave. What is the impact As a result, Burlington may not be effective in enforcing Lottery Licence terms and conditions.

These measures have greatly improved the response time in receiving audit reports Action Plan: 1. Continue to monitor and

issue written notices for outstanding audits.

2. Ensure when staff are away

for an extended period, the audit reports they are responsible for are monitored and followed up with as required.



Representatives Target Date: Completed


APPENDIX A-2: ADDITIONAL OBSERVATIONS

Observation Recommendations The Burlington lottery compliance framework has not been recently reviewed and currently, no subject matter expert has been assigned to monitor legislation updates. Areas of Burlington’s compliance with the AGCO Lottery Licensing Policy Manual (LLPM) requiring further review may include: Compliance with the LLPM requirement to “ensure that

licencees comply with the terms and conditions (T&Cs) of their licences”.

Compliance with the requirement to continuously review and

reassess organizations to ensure continued eligibility.

Ensuring that Burlington’s checklist “Requirements for Lottery Licence Eligibility Application” is consistent with the LLPM.

Fully utilizing tools provided by the AGCO. E.g., adopting the AGCO checklist that the licensing officers should use when determining applicant’s eligibility status.

Assign accountability for monitoring of legislation updates in order to keep Burlington's procedures up-to-date and compliant.

Work with legal and AGCO to develop a procedure related to

licence T&C compliance. Design and implement a process to for ongoing eligibility

reviews.

Building Administration and Licensing does not generate business licences and renewals at the time the application is received and reviewed by the City. As a result, customers have to wait to receive the new business licence, the City is incurring additional handling and postage costs and the subsequent processing is increasing the risk of errors.

Currently, the front-end staff review and accept the application. Approved applications are placed in the queue for data entry in AMANDA and printing / mailing by back-end staff.

If the CSRs enter the application into AMANDA and print the business licence at the time the application is accepted, the customer would have the option to receive business licence immediately and Burlington’s processing could be more streamlined.


APPENDIX A-2: ADDITIONAL OBSERVATIONS

Observation Recommendations Customers are required to obtain the City of Burlington Zoning signatures on the application before the Building Administration & Licensing accepts the application for business licence. The zoning approval on the application may not be legible.

Work with the Zoning department and IT to utilize the AMANDA workflow – i.e., zoning department may already have a folder in AMANDA for the property with that zoning approval. Alternatively, consider retaining zoning approval signatures on file / utilizing stamps, to minimize the risk of applications without the appropriate zoning approval.

Colleagues interviewed had inconsistent understanding of guidelines for the following areas:

Late fees - some colleagues believed they needed an advance approval for waiving late fees, while others indicated late fees were at their discretion.

Roles and responsibilities related to cash handling – although nine staff share a single cash register, staff were not aware of their responsibility should there be a difference.

Develop a strategy for handling of late fees and educate the licensing officers to ensure consistency.

Define roles and responsibilities for cash handling and protocols for resolving cash shortages.


LEGENDS & INTERNAL AUDIT STANDARDS Overall Audit Rating Audit Finding Severity Scale

Internal Audit Standards

Audit Methodology

The audit was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing. The City Auditor relied upon interviews with and observation of key personnel, examination of information, data, and other documentary evidence and re-testing of controls.

Audit Conclusions

The conclusions reached in this report are based upon information available at the time. The overall conclusion is only applicable to the function/area of this audit. It reflects the professional judgment of the Office of the City Auditor based on a comparison of situations as they existed at the time against audit criteria as identified in the scope of the audit.

Reasonable Assurance

This conclusion is intended to provide reasonable assurance regarding internal controls. There are inherent limitations in any controls, including the possibility of human error and the circumvention or overriding of controls. Accordingly, even effective controls may provide only reasonable assurance with respect to City operations.

Rating Description

Excellent (Green)

• No internal control weaknesses noted. • Good adherence to laws, regulations, and policies. • Good control environment. • Operations are considered efficient and effective.

Good (Yellow)

• Several low and/or one or two medium findings. • Minor contraventions of policies and procedures with

compensating controls in place. • No violation of laws. • Minor opportunities for improvement in efficiency and

effectiveness.

Fair (Orange)

• Many medium findings and/or one or two high findings. • Several contraventions to policy. • Minor violations of regulations/laws with minimal

impact to City. • Moderate opportunities for improvement in efficiency

and effectiveness.

Weak (Red)

• Several high findings and some medium and/or low findings

• Controls weak in one or more areas. • Noncompliance with policies put the City at risk. • Violation of law/regulation put the City at risk. • Substantial opportunities for improvement. • Operations are considered consistently inefficient

and/or ineffective

Severity Details

High (Red)

• Key control does not exist, is poorly designed or is not operating as intended

• Serious non-compliance to policy or regulation • May result in immediate or material loss/misuse of

assets, legal/regulatory action, material financial statement misstatements, etc.

• Indicates a serious business control weakness/deficiency requiring immediate action

Medium (Yellow)

• Key controls are partially in place and/or are operating only somewhat effectively

• Some non-compliance to policy or regulation • May negatively affect the efficiency and effectiveness of

operations and/or financial reporting accuracy. • Indicates a business control concern requiring near-term

action be taken

Low (Green)

• Key controls are in place, but procedures and/or operations could be enhanced.

• Minor non-compliance to policy or regulation • May result in minor impact to operations. • Indicates a business control improvement opportunity for

which longer-term action may be acceptable Nominal • Housekeeping

Documents

Recommendation: For information only Respond to